CVE-2025-21084
Published: 04 March 2025
Summary
CVE-2025-21084 is a low-severity NULL Pointer Dereference (CWE-476) vulnerability in Openatom Openharmony. Its CVSS base score is 3.8 (Low).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 23.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-21084 is a NULL pointer dereference vulnerability (CWE-476) affecting OpenHarmony versions v5.0.2 and prior. Published on 2025-03-04, it enables a local attacker to achieve arbitrary code execution within pre-installed applications.
The vulnerability can be exploited by a local attacker with low privileges (PR:L), requiring low attack complexity (AC:L) and no user interaction (UI:N). Successful exploitation is confined to restricted scenarios and results in low confidentiality impact (C:L) with no integrity or availability effects (I:N/A:N), though the scope is changed (S:C), yielding a CVSS v3.1 base score of 3.8.
Mitigation guidance is available in the OpenHarmony security disclosure advisory at https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-03.md.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-7581
Vulnerability details
in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through through NULL pointer dereference.. This vulnerability can be exploited only in restricted scenarios.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local low-privileged attacker exploiting NULL pointer dereference for arbitrary code execution in pre-installed apps directly enables T1068 Exploitation for Privilege Escalation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the NULL pointer dereference vulnerability in OpenHarmony by applying vendor-provided patches from the security advisory.
Implements memory protection mechanisms such as address space randomization and non-executable stacks to prevent arbitrary code execution from NULL pointer dereferences.
Requires secure error handling to detect and gracefully manage NULL pointer conditions, reducing the risk of exploitation for code execution.